BOOTP

BOOTP (Boot Protocol) may be used to boot remote computers over a network. BOOTP messages are encapsulated inside UDP messages and therefore its requests and replies are forwarded by routers. BOOTP is defined by RFCs 951 and 1542. The drawing below illustrates the data encapsulation:



The diskless system reads its unique hardware address from its network interface card then sends a BOOTP request. The table below shows the BOOTP package format from most significant bit to least significant bit.

Bit range # of Bits Name Description 0-7 8 Op code Tells if the message is a BOOTP request or reply. Request=1, reply=2 8-15 8 Hardware type Indicates the type of hardware (link level). A value of 6 indicates ethernet 16-23 8 Hardware address length Tells the length in bytes of the hardware address number. Ethernet addresses are 6 bytes long. 23-31 8 Hop count Initially set to 0. Incremented each time it is forwarded. 32-63 32 Transaction ID A random number set by the client and returned by the server. Used to match replies with requests 64-79 16 Number of seconds The time since the client started trying to bootstrap. Used to tell if a backup BOOTP server should respond. 80-95 16 unused not used 96-127 32 Clients IP address The clients IP address. If a request, it is normally 0.0.0.0 128-159 32 IP address for client The server sets this in the reply message. 160-191 32 Server IP address Filled in by the server. 192-223 32 Gateway IP address Returned by the server. 224-351 128 Clients hardware address Provided by the client. 352-1375 1024 Server hostname A null terminated string optionally filled in by the server. 1376-3423 2048 Boot filename A fully qualified boot file name with path information, terminated with a null. Supplied by the server. 3424-4447 1024 Vendor information Used for various options to BOOTP including the subnet mask to the client.

The BOOTP server uses port 67 and the BOOTP client uses port 68. The following is a brief explanation of what happens when a remote client boots:

1. BOOTP request. The client sends a BOOTP request from 0.0.0.0.68 to 255.255.255.255.67 with its ethernet address and number of second's fields filled in.
2. BOOTP reply. The server responds with the client's IP address, the server's IP address (it's own), and the IP address of a default gateway.
3. ARP request. The client issues an ARP to tell if the IP address it just received is being used. It uses 0.0.0.0 as it's own address
4. ARP request. The client waits 0.5 seconds and repeats the same ARP request.
5. ARP request. The client waits another 0.5 seconds and repeats the ARP request with it's own address as the senders address.
6. BOOTP request. The client waits 0.5 seconds and sends another BOOTP request with its own IP address in the IP header
7. BOOTP reply. The server sends the same BOOTP reply it sent the last time.
8. ARP request. The client outputs an ARP request for the server hardware address
9. ARP reply. The server replies with its own ethernet address.
10. TFTP read request. The client sends a TFTP read request asking for its specified boot file.

http://www.comptechdoc.org/independent/networking/guide/netbootpdhcp.html